diff --git a/vars/applyConfigPolicy.groovy b/vars/applyConfigPolicy.groovy
index 8c2257f..919f039 100644
--- a/vars/applyConfigPolicy.groovy
+++ b/vars/applyConfigPolicy.groovy
@@ -1,3 +1,10 @@
+import groovy.transform.Field
+
+@Field
+def DOCKER_ARGS = '''\
+-v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+'''
+
 def call(rw_limit, stages) {
     properties([
         pipelineTriggers([cron('H H * * *')])
@@ -11,7 +18,7 @@ def call(rw_limit, stages) {
                     "configpolicy:${env.BRANCH_NAME}",
                     'ci',
                 )
-                image.inside {
+                image.inside(DOCKER_ARGS) {
                     withEnv(["KRB5CCNAME=${WORKSPACE}/.krb5cc"]) {
                         stageKinit()
                         try {